Separation of Powers and Cybersecurity
Overview The U.S. Constitution divides powers relating to national security between the executive and legislative branches. * Article I of the U.S. Constitution empowers Congress to "declare war," "raise and support armies," "provide and maintain a navy," and "make rules for the government and regulation of the land and naval forces."U.S. Const. Art. I, §8. * Article II states that the "President shall be Commander in Chief of the Army and Navy of the United States, and of the Militia of the several States."U.S. Const. Art. II, §2, cl. 1. As a preliminary matter, invocation of war powers begs a question regarding the scope of the Commander in Chief's role in a modern conflict that, not least in the context of cyber warfare, defies traditional military strategies. Many facets of cybersecurity, such as components directing planning, development, and education, fall outside of traditional definitions of war. In addition, war powers would likely not apply to actions which mandate private sector security measures. However, many believe the Commander-in-Chief power extends beyond warfare to encompass a broad conception of national security. In addition, although the phrase "war powers" evokes international conflicts, it seems that the President's war powers authorize at least some domestic action. For example, some have argued that the President's Commander-in-Chief power authorizes him to create a domestic intelligence agency.RAND Corporation, "The Challenge of Domestic Intelligence in a Free Society: A Multidisciplinary Look at the Creation of a U.S. Domestic Counterterrorism Intelligence Agency" 108 (2009) (arguing that for establishing a domestic intelligence agency, the Constitution "tilts the balance of power toward the President by virtue of the Commander-in-Chief clause"). Alternatively, the President's foreign affairs powers might provide an inherent constitutional authorization for executive action on cybersecurity. Given modern communications technology and the ease of travel, it is increasingly difficult to draw clean lines between foreign and domestic affairs. Congress' attempts to distinguish between foreign and domestic actors in other areas impacted by rapidly changing technological environments serve as examples. For instance, in the context of electronic surveillance, statutory provisions have progressed from drawing definitive distinctions between people located in the United States versus abroad in the original Foreign Intelligence Surveillance Act of 1978 to a 2007 amendmentProtect America Act, Pub. L. No. 110-55 (2007). excluding from the scope of foreign surveillance any person "reasonably believed" to be located abroad. Finally, the President might assert that his oath-based obligation to defend the nation from imminent threats, sometimes termed the "emergency theory," provides a constitutional basis for executive action to prevent cyber intrusions or attacks. Presidents have relied on this authority very rarely.Some attorneys within the Bush Administration relied on the emergency powers argument to assert that President Bush had inherent authority to use military force in the war on terror. See, e.g., Memorandum Opinion for the Deputy Counsel to the President, "The President's Constitutional Authority to Conduct Military Operations Against Terrorists and Nations Supporting Them" (Sept. 25, 2001) (full-text). Assuming that the President's war or foreign affairs powers extend to national security efforts such as the Comprehensive National Cybersecurity Initiative, the next question is whether, and in what circumstances, the executive branch exercise of such powers might be constrained by congressional action. As discussed, Congress and the President share powers to address matters of national security, and no precise line divides the powers of the two political branches. Some have identified a narrow sphere of Article II authority, sometimes called "preclusive" power,The term "preclusive" appeared in Justice Jackson's concurring opinion in Youngstown Steel and Tube Co., 343 U.S. 579 (1952), when he referred to Article I authorities that, if exercised, would preclude a conflicting action by Congress as "at once so conclusive and preclusive they must be scrutinized with caution." Id. at 638 (Jackson, J., concurring). which congressional action cannot limit. For most situations, however, Justice Robert Jackson's concurring opinion in Youngstown Steel & Tube Co.Id. establishes the leading doctrine governing the executive's inherent constitutional authority vis-a-vis Congress.See Hamdan v. Rumsfeld, 548 U.S. 557, 638 (2006) ("The proper framework for assessing whether executive actions are authorized is the three-part scheme used by Justice Jackson in his opinion in Youngstown"). Justice Jackson's three-category framework requires courts to evaluate, where possible, the interplay between congressional intent and executive action in the context of the Constitution's allocation of powers. This exercise is made more difficult by the murky nature of a small category of inherent constitutional powers some believe are reserved to the President alone. During the Korean War, President Truman signed an executive order directing the Commerce Secretary to take control of the nation's steel mills in order to prevent a national steelworkers' strike. In Youngstown, also known as the "Steel Seizure Case," the government claimed that presidential powers inherent in Article II provisions, most notably the Commander-in-Chief power, authorized President Truman's action.343 U.S. at 587. To prove this claim, the government characterized the industry seizure as an action of a Commander-in-Chief, prompted by exigencies of war: steel production was necessary for military operations in Korea.Id. The Supreme Court rejected this claim,Id. The Court noted that "'theater of war' is an expanding concept." Id. Nonetheless, the Court "not with faithfulness to our constitutional system hold that the Commander in Chief of the armed forces has the ultimate power as such to take possession of private property in order to keep labor disputes from stopping production." Id. but justices reached the conclusion by different analytical routes. Writing for the majority, Justice Black took the hard-line view that the Commander-in-Chief clause gives the President no substantive authority. He emphasized that controlling private property to affect labor disputes "is a job for the nation's lawmakers."Id. In contrast, Justice Jackson argued that the President's inherent constitutional powers "fluctuate," from relatively high when authorized by Congress, to their "lowest ebb" when a president "takes measures incompatible with the express or implied will of Congress."Id. at 635-38 (Jackson, J., concurring). Specifically, Justice Jackson articulated three categories of executive action: (1) action supported by an express or implied grant of authority from Congress]; (2) a "zone of twilight" between the other categories, in which "congressional inertia" can occasionally "enable, if not invite, measures on independent presidential responsibility"; and (3) action that conflicts with statutes or congressional intent.Id. Actions in the first category enjoy congressional support and thus might not need to rely solely on an inherent constitutional powers argument; assuming that Congress acted pursuant to an enumerated Article I power in delegating the authority, these actions are clearly authorized unless they violate another constitutional provision. Actions in the second, "zone of twilight"The phrase "zone of twilight" refers to the mesopelagic region of the ocean — the last region which light reaches, but it also has a non-scientific definition of an indefinite area between two conditions. Under Justice Jackson's framework, the President and Congress might have concurrent authority in this category, such that it is not always clear what, if any, power one branch has to supersede actions of the other. category prompt a complicated, totality-of-the circumstances inquiry, in which courts determine congressional intent vis-a-vis executive action. Actions that fall within the third category — that is, actions that conflict with statutory law ‐ generally lack constitutional authority, unless the action is one of the few types of actions over which the President has exclusive authority. In Youngstown, Justice Jackson found that President Truman's actions fit within the third category, because Congress had not left the issue of property seizure during labor disputes to an "open field"; rather, Congress had passed statutes designed to stabilize markets when government required supplies.Id. at 639 (Jackson, J., concurring). On this basis, Justice Jackson joined the majority to strike down President Truman's seizure of the steel industry.Id. Given the existing statutory framework, at least some potential responses to cyber threats would likely fall outside of the first of Justice Jackson's categories. Congress has not expressly authorized the cybersecurity reforms proposed by the CNCI, nor do the Federal Information Security Management Act of 2002 or related statutes appear to impliedly authorize all potential cybersecurity protections. In addition, although the use of cyber force might have congressional authorization under the 2001 Authorization for Use of Military ForcePub. L. No. 107-40, 115 Stat. 224 (2001). if directed against an al Qaeda or Taliban operative, the Supreme Court has appeared to foreclose reliance on the Authorization as a basis for any action that is not a "fundamental" incident to the use of force against those responsible for the 9/11 attacks. The 2001 joint resolution authorized the use of "all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided" the 9/11 attacks.Id. In Hamdi v. Rumsfeld, the Supreme Court held that capture and detention of Taliban members constituted "so fundamental and accepted an incident to war as to be an exercise of the 'necessary and appropriate force' Congress has authorized the President to use."542 U.S. 507, 518 (2004). However, the Hamdi court held that such authority is limited by detainees' rights under the due process clause. Id. The Court seemed reluctant to interpret the Authorization as extending to detentions beyond this "limited category."Id. Cybersecurity efforts that focus on information gathering activities may parallel the role of intelligence collection as a "central component of the war on terrorism."David J. Barron & Martin S. Lederman, "The Commander in Chief at the Lowest Ebb–Framing the Problem, Doctrine, and Original Understanding," 121 Harv. L. Rev. 689, 714 (2008) ("a central component of the war against terrorism is, by its nature, the collection of intelligence"). However, not all cybersecurity threats fit logically within the scope of the so-called "War on Terror." Cyber intrusions conducted by individual computer hackers, not supported by or aligned with a nation or terrorist organization, are perhaps best characterized as ordinary criminal activity whereas orchestrated intrusions by foreign security or intelligence entities might belong in a category of routine foreign-intelligence gathering. Neither activity appears to fit the mold of wartime operations. On the other hand, to the extent that the primary aim of the War on Terror is to prevent terrorists from harming U.S. civilians or assets, one might argue that defending the United States against threats to the U.S. cyber and telecommunications infrastructure fits squarely within the War's parameters.See id. (noting that the war on terrorism differs from conventional conflicts, in part, because "the Executive has identified its principal goal in this conflict not as defeating the enemy in battle, but as preventing the enemy from 'fighting' in the first place"). Nonetheless, it seems unlikely that all aspects of the CNCI would fit within the Hamdi interpretation of the 2001 Authorization. On the other hand, unless Congress takes legislative action that contravenes a proposed executive response, the third category in Justice Jackson's framework is inapplicable. In contrast to intelligence collection efforts through the use of electronic surveillance, which Congress explicitly limited in the Foreign Intelligence Surveillance Act of 1978, Congress has not expressly limited executive action on cybersecurity. Although Congress has not left the cybersecurity arena an entirely "open field," by virtue of its modest actions with regard to the Federal Information Security Management Act of 2002 and related provisions, it has not occupied the field to the extent that it had occupied the arena of labor regulation at issue in Youngstown. Therefore, the CNCI and other potential executive actions taken to address cybersecurity likely fall within Justice Jackson's second, "zone of twilight" category, in which the executive and legislative branches have shared authority to act. A 1981 case, Dames & Moore v. Regan, refined the Supreme Court's approach to evaluating actions that lie within this "zone of twilight."453 U.S. 654 (1981). In Dames, then-Justice Renquist, writing for the majority, clarified that in "zone of twilight" cases, the analysis, at least so far as separation-of-powers principles are concerned, "hinges on a consideration of all the circumstances which might shed light on the views of the legislative branch toward executive’s action, including 'congressional inertia, indifference or quiescence.'"Id. at 669. Thus, the inquiry in such cases becomes a balancing act, aimed toward ascertaining Congress' relationship to the subject matter at issue. In the context of the CNCI, Congress' actions to date on cybersecurity have been primarily criminal or administrative and do not represent a comprehensive response to the issue. In addition, the CNCI involves intelligence and foreign affairs issues that traditionally lie within the purview of the executive branch. Therefore, at least until Congress takes further action in the cybersecurity area, it appears that the executive branch is not precluded from implementing the CNCI or other cybersecurity responses under Justice Jackson's Youngstown framework. A final issue is whether responses to cybersecurity intrusions or attacks might be part of the narrow realm of "preclusive" constitutional powers belonging to the President.Scholars have expressed doubts regarding the framers' intent to imbue the President with "preclusive" constitutional powers but nonetheless have argued that long-standing assumptions that such powers exist have solidified their constitutional standing. See, e.g., David J. Barron & Martin S. Lederman, "The Commander in Chief at the Lowest Ebb–Framing the Problem, Doctrine, and Original Understanding," 121 Harv. L. Rev. 689, 802 (2008). Although the scope of, and even the constitutional authority for, such powers has never been fully defined, scholars have noted that a few key rules form a "rarely questioned narrative" regarding arenas in which Congress traditionally defers to executive action.See, e.g., id. at 698. For example, traditional notions dictate executive direction of wartime campaigns.See Hamdan v. Rumsfeld, 548 U.S. 557, 591-92 (2006) (citing Ex Parte Milligan, 71 U.S. 2, 139-40 (1866)). But see War Powers Resolution, 50 U.S.C. §§1541-48. Likewise, the Supreme Court has characterized the President as the "sole organ" of the country in conducting foreign affairs.See United States v. Curtiss-Wright Export Co., 299 U.S. 304, 319 (1936) ("'The President is the sole organ of the nation in its external relations, and its sole representative with foreign nations.'" (citing Annals, 6th Cong., col. 613 (statement of John Marshall))). However, the Curtiss-Wright case involved executive action that fell in the first of Justice Jackson's Youngstown categories — i.e., where Congress and the President acted in concert. Thus, although the case has helped to form a narrative regarding executive-branch prerogative in international relations and has occasionally been cited to support the proposition that the President has some preclusive foreign affairs powers under the Constitution, it would misstate the Curtiss-Wright holding to assume that it recognized any broad preclusive foreign relations power. In addition, some have suggested a distinction between offensive utilization of cyber weapons versus defensive shield to stop attacks:Aside from the operational distinction that may be made with respect to the types of cyber activities the U.S. may undertake, the offensive versus defensive distinction may also be worth considering from an organizational perspective. Agencies responsible for protecting the government's websites and launching counteroffensive attacks may not be the same entities responsible for assisting in the recovery phase of an attack of national security significance on a U.S. cyber or telecommunications hosted network. whereas the President must obtain congressional authorization before committing U.S. armed forces in an offensive action, the President’s has the exclusive power to repel attacks made against the United States. Despite this narrative, however, no definitive boundaries have been defined for any such preclusive powers. Perhaps for that reason, Justice Jackson made clear in his Youngstown concurrence that the realm of any such preclusive powers must be carefully scrutinized.343 U.S. at 638 (Jackson, J., concurring). Thus, although many executive actions in the cyber area would likely fall within the scope of Article II powers for ensuring national security, most actions would probably falls outside of the narrow categories of exclusive executive authority to conduct wartime campaigns and international relations. Similarly, even if the President has an exclusive power to lead the military in defensive actions, actions might not be clearly enough a defensive response to a military threat to trigger an exclusive presidential power.In the context of modern national security threats, the line between offensive and defensive action is not easily deciphered. For example, the United States captured and detained a large number of alleged enemy combatants in the course of post-September 11th military operations. Is the ongoing detention of such persons, often referred to as "preventative detention," an offensive action? The Supreme Court has upheld executive authority for such detentions on statutory rather than constitutional grounds; it has not addressed offensive versus defensive distinction. Hamdi, 542 U.S. 507. Thus, even if some components of the CNCI qualify as war-related activity, perhaps because they target cyber terrorists, little guidance exists regarding which actions might qualify as defensive rather than offensive actions under the traditional war powers analysis. Thus, it appears that the Youngstown framework would apply to a review of the President's authority to implement responses such as the CNCI. Thus, if Congress passed conflicting legislation in the cybersecurity area, some executive actions could be constrained. Alternatively, congressional legislation granting explicit authority for cybersecurity measures would more firmly confirm the executive authority to act in that area. It is possible that the Supreme Court will address the constitutional authorities for national security in a future case. Youngstown represents one of only a small number of cases in which the Supreme Court has reached questions regarding the political branches' shared powers under the Constitution. Modern threats might necessitate new definitions within the Court's separation-of-powers jurisprudence. For example, as cyber activities and telecommunication architectures are networked globally, with it often being difficult to ascertain where an attack or intrusion emanates, distinctions based on notions of conventional war may seem increasingly inconsistent with the modern Commander-in-Chief role. References Source * Comprehensive National Cybersecurity Initiative: Legal Authorities and Policy Considerations, at 10-15. Category:Cybersecurity